Fix CI security audit permissions and ignore transitive advisories

[mlevkov]

Summary

Fixes CI security audit workflow permission issues and addresses unmaintained transitive dependency advisories.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• CI/CD changes

Changes Made

CI Fix

• Added issues: write permission to the security audit job in .github/workflows/ci.yml
• This allows rustsec/audit-check to create issues when unmaintained crate warnings are found

Security Advisory Ignores

• Added ignore rules in deny.toml for unmaintained transitive dependencies:
  • RUSTSEC-2024-0384 (instant): from iggy -> reqwest-retry -> parking_lot v0.11
  • RUSTSEC-2025-0134 (rustls-pemfile): from testcontainers -> bollard (dev-dep only)
• Both are transitive dependencies we cannot directly update - we are already on the latest versions of iggy and testcontainers

Documentation

• Updated CHANGELOG.md with the fixes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed

Test commands run:

# Verified CI workflow syntax
# Changes will be validated by CI run on this PR

Checklist

Code Quality

• Code follows project style guidelines (cargo fmt)
• No new Clippy warnings (cargo clippy -- -D warnings)
• Public APIs have documentation comments
• Error handling is appropriate (no unwrap in production code)

Testing

• Tests cover the happy path
• Tests cover error cases
• All existing tests pass

Documentation

• CLAUDE.md updated (if architectural changes)
• README updated (if user-facing changes)
• Code comments explain "why" not "what"

Security

• No secrets or credentials committed
• Input validation added where needed
• No new security vulnerabilities introduced

Related Issues

Fixes scheduled CI failures caused by missing issues: write permission on security audit job.

Additional Notes

The unmaintained crate warnings are for transitive dependencies:

• instant is pulled in by parking_lot v0.11.2 which is used by reqwest-retry in the iggy SDK
• rustls-pemfile is pulled in by bollard which is used by testcontainers (dev dependency only)

We are already on the latest versions of both iggy (0.8.0-edge.6) and testcontainers (0.26.0). The upstream packages need to release updates to resolve these advisories.